Actually...I found it.......Source was capitalized and in the regular search it is not. I see that this is extremely case sensitive
Thanks TP On Friday, January 20, 2017 at 3:44:54 PM UTC-6, Tom Powers wrote: > > Hello Everyone!! > > Total Noob to Graylog...but I have read the docs and have scoured the net > for this. > > Brand new Graylog2.1 from OVA. > > Sending data into it from windows event logs via nxlog > > Everything works great...I can get searches on ExventIDs, create streams > and dashboards. > > here's the question: > > If I do a simple search from the main screen like > source:tp2015.ssi.private I get all the messages from the node with > that name. > > If I go to make a stream for this...and select the source match > exactly tp2015.ssi.private as the only rule....I get nothing > > What am I missing or not understanding here? > > All insight is appreciated > > Thanks > > TP > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/99bc4e61-70cc-4e39-8081-fbea15f5208e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
